PDFZorro PDFZorro Online r20220428 using TCPDF 6.2.5, despite having workflows claiming to correctly remove redacted information from a supplied PDF file, does not properly sanitize this information in all cases, causing redacted information, including images and text embedded in the PDF file, to be leaked unintentionally. In cases where PDF text objects are present it is possible to copy-paste redacted information into the system clipboard. Once a document is "locked" and marked for redaction once, all redactions performed after this feature is triggered are vulnerable.
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
The source code contains comments that do not accurately describe or explain aspects of the portion of the code with which the comment is associated.
| Link | Tags |
|---|---|
| https://www.pdfzorro.com/pdf-edit/ | product |
| https://arxiv.org/pdf/2206.02285.pdf | third party advisory |